EP3375673B1 - Safety method for a safety system of a vehicle - Google Patents

Description

The present invention relates to a safety method for a safety system of a vehicle according to the preamble of the independent method claim. The invention also relates to a security system according to the preamble of the independent device claim.

It is known from the prior art that a portable access device, for example a smartphone or an ID transmitter, can be used to activate a safety-relevant function in a vehicle. Such a function is, for example, the granting of access to the vehicle or an authorization to start the engine. For this purpose, a security system of the vehicle can be provided which, for example, carries out and / or evaluates data transmission between the vehicle and the access device. Through the

Evaluation of the data transmission can, for example, measure a distance between the access device and the vehicle and / or an approach of the access device can be detected. For example, the security-related function can only be activated when the access device is in the vicinity of the vehicle. This enables, for example, the provision of a passive access system (keyless entry system).

Conventional security systems use "connection-related data transmission" to ensure security when the function is activated. For example, authentication can then take place when the connection is established. Here, however, the disadvantage has turned out that such a data transmission, in particular the connection setup, can only be carried out in a costly, inflexible and complicated manner. It may also be a technical challenge to adequately limit connection interruptions and / or connection errors in connection-related data transmission.

In principle, "connectionless communication" can also be used for data transmission. However, the use of connectionless data transmission has the disadvantage that the transmitted data packets are not easily protected against manipulation and are usually addressed to everyone. In other words, the integrity of the transmitted data may not be adequately ensured or it may only be ensured in a technically complex manner. In the case of passive security, in particular access systems, which use the received power during data transmission as a reference point for the approach of an access device, this can lead to the wrong device being detected for a distance measurement

DE 10 2013 224 330 A1 discloses a method and system for detecting approach of a terminal to a vehicle based on the signal strength information received over a Bluetooth low energy transmit channel (BLE).

It is therefore an object of the present invention to at least partially remedy the disadvantages described above. In particular, it is an object of the present invention to provide a more reliable and / or more secure authentication and / or distance measurement and / or data transmission in a security system, in particular an access system, of a vehicle. Preferably, the possibility of authenticating oneself via an access device in the vehicle (in particular contactless / by radio) should be simplified and improved.

The above object is achieved by a security method with all the features of the independent method claim and by a security system with all the features of the independent system claim. Further features and details of the invention emerge from the respective subclaims, the description and the drawings. Features and details that are described in connection with the security method according to the invention naturally also apply in connection with the security system according to the invention, and vice versa, so that with regard to the disclosure of the individual aspects of the invention, reference is or can always be made to each other.

The object is achieved in particular by a security method for a security system, in particular an access system, of a vehicle, for activating at least one security-relevant function in the vehicle according to claim 1 and by a method according to claim 13.

• Eine Freigabe eines Zugangs zum Fahrzeug, vorzugsweise die Aktivierung eines Schließsystems des Fahrzeuges für einen Benutzer, bspw. ein Entriegeln des Fahrzeuges, vorzugsweise automatisch und/oder nur dann, wenn das Zugangsgerät innerhalb eines vorgegebenen Maximalabstands zum Fahrzeug lokalisiert wird,
• eine Freigabe eines Motormanagementsystems des Fahrzeuges, insbesondere eine Freigabe eines Motorstarts, vorzugsweise automatisch und/oder nur dann, wenn das Zugangsgerät und/oder der Benutzer im Fahrzeuginnenraum lokalisiert wird,
• eine Deaktivierung einer Alarmanlage des Fahrzeuges, vorzugsweise automatisch und/oder nur dann, wenn das Zugangsgerät innerhalb eines Maximalabstands zum Fahrzeug lokalisiert wird,
• eine Verriegelung des Fahrzeuges, insbesondere automatisch und/oder nur dann, wenn das Zugangsgerät außerhalb eines Maximalabstands zum Fahrzeug lokalisiert wird.

For example, the safety-relevant function can include at least one of the following functions:

• A release of access to the vehicle, preferably the activation of a locking system of the vehicle for a user, e.g. an unlocking of the vehicle, preferably automatically and / or only when the access device is located within a predetermined maximum distance from the vehicle,
• a release of an engine management system of the vehicle, in particular a release of an engine start, preferably automatically and / or only when the access device and / or the user is located in the vehicle interior,
• deactivation of an alarm system in the vehicle, preferably automatically and / or only when the access device is located within a maximum distance from the vehicle,
• locking of the vehicle, in particular automatically and / or only when the access device is located outside of a maximum distance from the vehicle.

The detection of the approach of the access device and / or the construction / implementation of the data transmission can preferably be initiated automatically by the vehicle. For example, a wake-up signal can be sent out for this purpose and / or at least one proximity sensor of the vehicle can be evaluated in order to initiate the data transmission. In this way a passive access system can be provided. Alternatively or additionally, the data transmission can also be initiated by the access device.

It is conceivable that the portable (in particular mobile) access device is designed as an identification transmitter (ID transmitter) and / or as a communication device such as a smartphone or laptop, in particular a cellular communication device, preferably with a cellular radio interface. This enables comfortable, flexible and inexpensive activation of the function. The access device preferably comprises a radio interface, in particular a Bluetooth interface, preferably a Bluetooth low energy interface, for carrying out the data transmission.

The data transmission is preferably implemented as a connectionless data transmission between the access device and the vehicle, so that, for example, the data (packets) transmitted thereby are not (necessarily or always) authenticated in a forgery-proof manner.

For example, the data transmission is carried out as a Bluetooth, in particular Bluetooth Low Energy, data transmission, in particular in the so-called Bluetooth advertising mode (in contrast to the connection mode for connection-based Bluetooth communication, between at least two specified partners / devices). In other words, the data can be transmitted via broadcasting communication (to anyone or to each partner / device). This has the advantage that the data transmission can be carried out in a simple and quick manner, in particular without complex connection establishment.

The "vehicle-side" assignment is understood to mean that the assignment is made by the vehicle, in particular by the security system, preferably by vehicle electronics, preferably by an evaluation according to the security mechanism, for example by using a verification key and / or by a comparison of the security feature with at least one specification (for example an assignment table). In particular, the checking and / or assignment can take place independently of the communication channel, ie only on the basis of the data of the data unit received by the vehicle. This has the advantage that, regardless of the security precautions in the data transmission as such, ie in particular in the case of the communication channel, integrity and authorship of the data unit can be guaranteed and the data unit can be reliably assigned to the access device.

It can also be possible that an assignment on the vehicle side is also understood to mean further communication of the vehicle, in particular via the Internet, for example with a server or another device. An assignment table can then be called up, for example, from the server or further device and / or the actual assignment can be made on the basis of the security feature.

It is conceivable that the vehicle-side assignment of the access device can be carried out on the basis of the (useful) data of the data unit, for example by evaluating the security feature and / or at least one piece of useful data information assigned to the security feature. For this purpose, the security feature and / or the user data information is specific for the access device, i. H. allows reliable conclusions to be drawn about the access device.

According to the invention, the security feature is designed as an electronic, in particular digital, signature, for example in accordance with a digital signature method (as a security mechanism). The security feature can preferably be specific to the access device and / or the security mechanism, in particular be cryptographically permanently assigned to the access device and / or the security mechanism, and is preferably generated on the basis of a secret signature key. For example, on the basis of a public verification key (by processing the security feature) the assignment of the data unit to the access device, i. H. the authorship and integrity of the data unit, must be confirmed.

Alternatively or additionally, the security feature can be designed as a device-specific, ie for example manufacturer-specific, feature for the access device or can be determined on the basis of such a feature. The feature includes, for example, manufacturer-specific data of the access device. In particular, the security feature can be generated in that a randomized encryption algorithm is applied to this data. For example, the data can then be transmitted as useful data information of the data unit. In particular, by authenticating this data, the at least one data unit can then be assigned to a specific access device. Thus, the advantage can be obtained that each data unit has unique data which authenticate the access device in a forgery-proof manner. This can make it more difficult to simulate an approximation, since the data unit (in particular packets) cannot be repeated or calculated itself.

In particular, the data transmission does not take place as a connection-dependent transmission of the data unit, but rather as a connectionless, and thus preferably also unencrypted, transmission. An unencrypted transmission is understood to mean that the communication channel itself is unencrypted (whereas the user data, for example at the application level, can possibly also be encrypted or cryptographically secured). In other words, the activation of the function can be secured very flexibly and reliably by the security mechanism in that a (preferably cryptographic) security is provided by the security feature, in particular at the user data or application level.

For example, it can be provided that the security feature and / or user data information secured by the security feature is specific for the access device, in particular hardware-specific and / or manufacturer-specific. This allows, in particular in contrast to a simple connection-related transmission of a code, a device-specific assignment of the data unit. Preferably, when checking, not (only) the content of the user data of the data unit is checked, but also the integrity of the data transmission on the basis of the security feature. In other words, it can be checked whether the transmitted data unit originates correctly and unmodified from the authorized access device, and thus data integrity and authenticity is present.

The function can preferably be activated on the basis of the data transmission in that the (useful) data transmitted during the data transmission and / or information from the at least one communication interface used for this purpose are evaluated. For example, a signal strength at a receiving interface (ie, for example, at a receiving node) of the vehicle can be evaluated as such information. In particular, the signal strength can be evaluated in such a way that distance information about a distance between the vehicle and the access device is determined and / or localization is carried out. This makes it possible, for example To use distance information and / or localization for the decision whether the safety-relevant function should be activated or not.

It may further be possible for the security mechanism to be designed as a mechanism to ensure security and / or integrity and / or authenticity during data transmission, and preferably to include and / or parameterize a cryptographic signature method for determining a digital signature. For example, the security mechanism is specified in that at least one secret signature key and at least one public verification key and / or a table (assignment table) with device-specific information for different access devices to determine authorized access devices is specified and / or pre-stored for the security mechanism, in particular in the vehicle is saved permanently. For example, the device-specific information is in the form of hardware codes, so that a comparison of the device-specific information with transmitted user data information allows the data unit to be assigned to a specific access device. In a further step, the security feature can then be used to assess the integrity and / or authenticity of the user data information. Alternatively or additionally, the security feature can also already include the user data information so that, for example, a separate transmission of the user data information (in plain text) can be dispensed with. This is the case, for example, when the user data information is encrypted and then transmitted in encrypted form as a security feature of the data unit. In this case, ensuring the integrity preferably includes checking the correct content and / or an unmodified state and / or recognizing modifications and / or checking the temporal correctness of the data unit.

It is conceivable that the vehicle is designed as a motor vehicle and / or as an electric vehicle and / or as a hybrid vehicle and / or as a self-driving vehicle and / or as a passenger vehicle. In particular, the vehicle comprises at least part of the security system, for example as an active or passive access system and / or keyless go system or the like.

In addition, it can be advantageous within the scope of the invention that the data transmission is carried out unidirectionally and / or connectionlessly via radio communication technology, in particular via Bluetooth or Bluetooth Low Energy, preferably via a cryptographically unprotected communication channel, so that cryptographic protection is at least essentially (or primarily or exclusively) is provided by the security feature and / or the security mechanism. It may be possible that the data transmission is connectionless and / or unidirectional, so that preferably the access device as a transmitter and the security system on the vehicle, in particular at least one receiving node, are uncoupled as a receiver, and / or several receivers are simultaneously (or staggered) can receive the data unit (ie also other data units with the same content, possibly sent at different times). In particular, an unprotected communication channel is understood to mean that the communication channel itself (e.g. at the transport level or in relation to the control and / or protocol information) is unencrypted or only weakly protected, so that cryptographic security is primarily implemented by adapting the user data . For example, the data unit or the useful data of the data unit can be transmitted in plain text and / or by broadcast.

It may optionally be possible that the activation of the security-relevant function according to step d) takes place as a function of at least the check result and / or a signal strength when the data unit is transmitted, a distance between the access device and the vehicle preferably being determined on the basis of the signal strength, and the safety-relevant function is only activated when the distance is sufficiently small. In particular, a check of the check result offers the additional security that only an authorized and / or authenticated access device can be used to activate the function at a sufficiently short distance. For example, the signal strength can be determined on the basis of Received Signal Strength Indication (RSSI) data, in particular in the case of a receiving node in the vehicle, which is in particular designed as a Bluetooth interface.

According to the invention, the data unit comprises at least one piece of useful data information and, on the basis of the useful data information, the data unit on the vehicle side is assigned to the access device, the security feature (according to step a)) being determined on the basis of the user data information so that the user data information is signed for cryptographic protection of this assignment. In particular, after the data transmission, the integrity of the data unit and / or the useful data information can then be checked by evaluating the security feature. For example, for this purpose the security feature can be checked using a verification key. Alternatively or additionally, the user data information can also be checked (or decrypted) on the basis of the security feature (or the verification key).

• Überprüfen der Korrektheit und/oder Integrität und/oder Urheberschaft der Nutzdateninformation, bspw. durch Berechnung eines Prüfwertes anhand des Sicherheitsmerkmals und/oder eines Verifikationsschlüssels,
• Zuordnen der Nutzdateninformation und/oder der wenigstens einen Dateneinheit zu einem bestimmten Zugangsgerät,
• Überprüfen der Zuordnung dahingehend, dass das zugeordnete Zugangsgerät dazu autorisiert ist, die sicherheitsrelevante Funktion zu aktivieren, insbesondere anhand einer Zuordnungstabelle.

In particular, the security feature can fulfill at least one of the following functions (and for example at least one of the following steps can be provided):

• Checking the correctness and / or integrity and / or authorship of the user data information, for example by calculating a test value based on the security feature and / or a verification key,
• Assigning the user data information and / or the at least one data unit to a specific access device,
• Checking the assignment to the effect that the assigned access device is authorized to activate the security-relevant function, in particular using an assignment table.

The check value can preferably be correlated with the user data information in such a way that the check value must have a predetermined result in order to confirm the user data information. For this purpose, for example, a security and / or encryption algorithm can be applied to the user data information and / or the security feature in such a way that the integrity can be checked by comparing the security feature with the user data information.

For example, the security mechanism and / or checking the correctness and / or integrity and / or authorship of the user data information and / or checking according to step c) can at least partially use a symmetrical and / or asymmetric cryptographic method, for example a randomized encryption algorithm and / or an RSA signature method.

It can furthermore be possible that the user data information comprises at least one device-specific information item, in particular a device address of the access device, preferably a Bluetooth device address, the security feature (according to step a)) being preferably determined on the basis of the device-specific information, so that preferably (according to step c)) the device-specific information is authenticated and / or the data unit is assigned to the access device on the basis of the device-specific information. In particular, the device address or Bluetooth device address is offset against an IRK key (Identity Resolving Key). For the purpose of allocation, the device-specific information is preferably compared with specified information (for example an allocation table) and the check result is only defined as positive if there is a match, so that the safety-relevant function can be activated.

• Digitales Signieren einer Nutzdateninformation für die Dateneinheit, sodass vorzugsweise eine digitale Signatur als Sicherheitsmerkmal für die Dateneinheit berechnet wird, insbesondere durch das Zugangsgerät,
• Übertragen der Dateneinheit, wobei die (signierte) Nutzdateninformation und das Sicherheitsmerkmal als Nutzdaten der Dateneinheit von dem Zugangsgerät an das Fahrzeug übertragen werden, insbesondere gemäß Schritt b), wobei vorzugsweise die gesamten Nutzdaten und/oder die Nutzdateninformation der Dateneinheit unverschlüsselt übertragen werden, (dies bezieht sich insbesondere nur auf die Übertragung, sodass insbesondere die Nutzdaten oder die Nutzdateninformation selbst verschlüsselt sein kann, sodass ggf. nur die Übertragung unverschlüsselt, jedoch mit verschlüsseltem Inhalt der Nutzdaten, d. h. bspw. auf Applikationsebene und nicht auf Transport- bzw. Koppelelement- bzw. Schnittstellenebene verschlüsselt, erfolgt),
• Bestimmen der Abstandsinformation, insbesondere anhand der Datenübertragung, vorzugsweise anhand einer Messung einer Signalstärke bei der Datenübertragung, bevorzugt durch das Fahrzeug,

wobei vorzugsweise (gemäß Schritt c)) die Nutzdateninformation und/oder die Abstandsinformation anhand des Sicherheitsmerkmals überprüft, insbesondere authentifiziert, wird.Furthermore, it is conceivable that the activation (according to step d)) takes place as a function of a localization of the access device on the basis of at least one distance information (such as a signal strength during data transmission) about a distance between the access device and the vehicle, with (before step d)) at least one of the following steps is provided, which are preferably carried out one after the other or in any order (whereby individual steps can also be carried out repeatedly):

• Digital signing of user data information for the data unit, so that a digital signature is preferably calculated as a security feature for the data unit, in particular by the access device,
• Transmission of the data unit, with the (signed) user data information and the security feature being transmitted as user data of the data unit from the access device to the vehicle, in particular according to step b), with preferably all of the user data and / or the user data information of the data unit being transmitted unencrypted (this relates in particular only to the transmission, so that in particular the useful data or the useful data information itself can be encrypted, so that if necessary only the transmission is unencrypted, but with encrypted content of the useful data, ie for example at the application level and not encrypted at the transport or coupling element or interface level),
• Determination of the distance information, in particular on the basis of the data transmission, preferably on the basis of a measurement of a signal strength during the data transmission, preferably by the vehicle,

wherein preferably (according to step c)) the user data information and / or the distance information is checked, in particular authenticated, on the basis of the security feature.

The unencrypted transmission relates in particular only to the data transmission (i.e. in particular to the transport level). It is thus possible that connectionless transmission can also be used in order to increase the reliability and efficiency of the security system.

According to a further advantage, it can be provided that (in particular in step c)) the security feature and / or the user data information is cryptographically verified, preferably using at least one verification specification, such as a verification key, of the security mechanism, preferably using a verification algorithm and / or a verification key. The verification key is preferably pre-stored in the vehicle, for example in a non-volatile data memory of the vehicle. The verification key is particularly preferably cryptographically protected in order to prevent manipulation or unauthorized reading.

Furthermore, it is optionally provided that (in particular according to step c)) a positive check result is determined if the authenticity of the access device and / or the integrity of the data unit is successfully determined on the basis of the transmitted security feature, whereby preferably in step d) the activation (the safety-relevant function) only takes place if the check result is positive. This has the advantage that functions critical to safety can only be made available to authorized users of the vehicle.

It is also conceivable within the scope of the invention that the at least one data unit is transmitted unencrypted, at least on a transport-oriented level, and thus preferably at least one unencrypted control and / or protocol information item and / or at least partially unencrypted user data, in particular with at least one unencrypted user data item , wherein the data unit is preferably designed as a data packet, and the useful data preferably include at least the security feature in unencrypted form. In particular, (additional) encryption of the security feature is not necessary during data transmission (so that it can be present in the data unit in unencrypted form), since the security feature has already been determined by a cryptographic algorithm. A particularly reliable and simpler security check can thus be implemented.

For example, the data unit and / or data transmission is encrypted on the application-oriented level in accordance with the security mechanism. This includes z. B. an application layer according to the OSI model. The transport-oriented level includes, for example, the data link layer or the layers below the application layer or session layer according to the OSI model.

It can be provided within the scope of the invention that the security mechanism comprises at least one cryptographic method in order to preferably determine at least one assignment, in particular an authenticity, of the data unit (to the access device), the cryptographic method preferably being a digital signature method and / or based on at least one random value and / or rolling code is carried out. The security feature can preferably be implemented as a code in accordance with a rolling code method. Preferably, based on a shared secret (such as a symmetrical key) between the sender (access device) and receiver (vehicle or receiving node) and a cryptographic algorithm, the sender transmits a constantly changing code to the receiver for verification (verification). . For example, a so-called Keeloq algorithm is used for this.

A further advantage can be that the security feature and / or a piece of useful data information is specific for the access device, in particular in that the

Security feature and / or the user data information is determined directly or indirectly on the basis of device-specific information, in particular a device identifier, preferably an identity resolving key, of the access device. For example, the device-specific information can be or will be uniquely assigned to an access device, and in particular be permanently stored in the access device. The security in the process can thus be further improved.

It is also conceivable that (in particular in step c)) a localization of the access device, in particular distance information measured by the data transmission, preferably a measurement result of a distance measurement, preferably a signal strength measurement, is checked, in particular authenticated, on the basis of the security feature, with the Distance information is transmitted as at least one piece of useful data information of the data unit (in particular in step b)). This makes it possible to determine in a simple manner that the access device is sufficiently close to the vehicle.

In addition, it is optionally possible within the scope of the invention that (in particular according to step a)) the determination of the security feature takes place differently for different data units, preferably using a randomized encryption algorithm and / or a random value and / or a counter and / or the like. The security for activating the function can thus be further increased. In particular, the counter can generate consecutive numbering or the like, in particular by a counter unit (counter), for example to provide a rolling code.

Furthermore, it may be possible for the safety-relevant function to include at least a first function, in particular enabling access to the vehicle, and / or at least one second function, in particular enabling an engine management system of the vehicle, with the first function preferably only being activated then is when a minimum distance between the access device and the vehicle is detected on the basis of a localization, and preferably the second function is only activated when the access device is detected in the interior of the vehicle on the basis of the localization. This provides a very convenient way of activating the functions.

In a further possibility it can be provided that at least two or three or more receiving nodes of the vehicle are provided in order to preferably receive the data unit and / or carry out the data transmission, the receiving node and / or the data transmission being dependent on the reception and / or the data transmission. or a check of the integrity of the respectively received data units, a localization of the access device is carried out, and preferably the at least one security-relevant function is activated as a function of the localization. For example, the different signal strength signals of the individual receiving nodes can be used to carry out a particularly precise localization of the access device. For this purpose, for example, triangulation or the like can be used for localization (positioning).

According to a further advantage, it can be provided that a localization is carried out by a distance measurement, in particular a signal strength measurement, based on the data transmission at different receiving nodes of the vehicle, in particular based on the measured distance of the respective receiving nodes to the access device, the results of the distance measurement for the localization preferably being compared with one another become. Alternatively or additional location data, for example from a GPS (Global Positioning System), can preferably also be used, in particular to increase the location accuracy.

It can be provided within the scope of the invention that the data transmission takes place via a public advertising and / or broadcast mode, in particular a Bluetooth communication technology (ie also Bluetooth Low Energy), so that the transmitted user data, in particular also the security feature, is public can be evaluated and / or read, preferably by all receiving nodes of the vehicle. It is therefore basically conceivable that the transmitted user data of the data unit (s) can be intercepted and read out. The security mechanism provides the actual protection to ensure the integrity of the data unit. In particular, the data transmission can only take place unidirectionally.

It is also conceivable that user data information of the data unit contains at least the security feature and at least one security code for the security system, in particular an access system, wherein the activation according to step d) preferably takes place as a function of the security code. In other words, the security system can authenticate using the data unit.

The invention also relates to a security system for a vehicle for activating at least one security-relevant function in the vehicle on the basis of at least one data transmission between a portable access device and the vehicle according to claim 13.

The security system according to the invention thus has the same advantages as has been described in detail with reference to a security method according to the invention. In addition, the security system can be suitable to be operated according to a security method according to the invention. It is also optionally conceivable that the processing device is designed to carry out a security method according to the invention.

In particular, the at least one receiving node can be arranged on and / or in the vehicle, preferably permanently attached. As an alternative or in addition, the receiving nodes can each have at least one antenna, in particular a Bluetooth antenna, and / or each be designed as a Bluetooth interface, preferably a Bluetooth low energy interface.

Optionally, it can be provided that at least one first receiving node on the rear of the vehicle and / or at least one second receiving node in a door handle of the vehicle and / or at least one third receiving node in the vehicle interior and / or at least one fourth receiving node in the front area of the vehicle are provided, so that preferably Depending on a distance between the access device and the respective receiving node, the access device can be localized on the basis of the data transmission. Thus, by locating the access device, a more secure option for contactless activation of the security-relevant function can be provided.

Fig. 1

eine schematische Darstellung eines erfindungsgemäßen Sicherheitssystems,

Fig. 2

eine weitere schematische Darstellung eines erfindungsgemäßen Sicherheitssystems und

Fig. 3

eine schematische Darstellung zur Visualisierung eines erfindungsgemäßen Verfahrens.

Further advantages, features and details of the invention emerge from the following description, in which exemplary embodiments of the invention are described in detail with reference to the drawings. The features mentioned in the claims and in the description can be essential to the invention individually or in any combination. Show it:

Fig. 1

a schematic representation of a security system according to the invention,

Fig. 2

a further schematic representation of a security system according to the invention and

Fig. 3

a schematic representation for the visualization of a method according to the invention.

In the following figures, the same reference numerals are used for the same technical features from different exemplary embodiments.

In Figure 1 a security system 200 according to the invention is shown schematically. A vehicle 1 is shown which has at least one receiving node 210 for carrying out a data transmission D in the vehicle 1.

The data transmission D serves to detect the presence and / or approach of an access device 10 and / or a localization of the access device 10 and / or perform an authentication. In this way, the access device 10 can be used to activate a security-relevant function in the vehicle 1. For this purpose, for example, an authorized access device 10 is brought into the vicinity of the vehicle 1.

It can e.g. B. possible that as soon as the access device 10 comes within the receiving range of the vehicle 1 or the at least one receiving node 210, the data transmission D is carried out. This data transmission D then serves in particular to transmit at least one data unit 50 from the access device 10 to the vehicle 1. In order to ensure flexible and simple data exchange and / or communication between the access device 10 and the vehicle 1, the data transmission D is preferably carried out unencrypted and / or without a connection.

In Figure 2 it is shown that a plurality of receiving nodes 210 of the vehicle 1 can also be provided. For example, at least a first receiving node 210a and / or a second receiving node 210b and / or a third receiving node 210c and / or a fourth receiving node 210d can be attached to different positions of the vehicle 1. Possible positions are, for example, the vehicle interior and / or a door handle 2 and / or a rear area of the vehicle 1. In order to evaluate the transmitted data unit 50, a processing device 220 can be provided, for example. This can also be suitable, for example, to at least partially carry out the security method 100 according to the invention, in particular to carry out a check of the data unit 50.

In Figure 3 A security method 100 according to the invention is schematically visualized, in particular by the representative representation of a data unit 50. According to a first method step, at least one security feature 60 is determined in accordance with a predetermined security mechanism. According to a second method step, the data transmission D is carried out so that at least one data unit 50 with at least the security feature 60 and / or useful data information 70 is transmitted from the access device 10 to the vehicle 1. Subsequently, according to a third method step, the transmitted data unit 50 can be checked on the basis of the transmitted security feature 60 according to FIG Safety mechanism take place in order to assign the data unit 50 on the vehicle side to the access device 10, so that a check result is determined. To determine the check result and / or to assign the data unit 50 to the access device 10, the user data information 70 can also be evaluated as device-specific information 70 of the data unit 50. Furthermore, in particular in order to further increase the security, several receiving nodes 210 of the vehicle 1 can be provided, which the at least one data unit 50 can receive. This enables the access device 10 to be reliably localized on the basis of information obtained at the respective receiving nodes 210 (such as a signal strength of the respective data transmission to the respective receiving nodes 210). The safety-relevant function can thus be activated in a simple and secure manner as a function of at least the check result.

The above explanation of the embodiments describes the present invention exclusively in the context of examples.

List of reference symbols

1

vehicle

2

Door handle

10

Access device

50

Data unit

60

Security feature

70

User data information, device-specific information

100

Security procedures

200

security system

210

Receiving node

210a

first receiving node

210b

second receiving node

210c

third receiving node

210d

fourth receiving node

220

Processing device

D.

Data transfer

Claims (14)

1. Security method (100) for a security system (200) of a vehicle (1), for activating at least one security-relevant function on the vehicle (1) by means of at least one data transmission (D) between a portable access device (10) and the vehicle (1),
   characterized by the following steps:

   a) determining at least one security feature (60) according to a predetermined security mechanism,

   b) performing the data transmission (D) so that at least one data unit (50) with at least the security feature (60) is transmitted from the access device (10) to the vehicle (1),

   c) verifying the transmitted data unit (50) based on the transmitted security feature (60) according to the security mechanism to associate the data unit (50) to the access device (10) on the vehicle side so that a verification result is determined,

   d) activating the security-relevant function depending on at least the verification result, wherein
   the data unit (50) comprises user data information (70), and the data unit (50) is associated to the access device (10) on the vehicle side on the basis of the user data information (70), wherein the security feature (60) is determined according to step a) on the basis of the user data information (70) for the cryptographic protection of this association in order to sign the user data information (70), wherein the security feature (60) is designed as an electronic signature.
2. Security method (100) according to claim 1,
   characterized in that
   the data transmission (D) is carried out without connection via a radio communication technology, in particular via Bluetooth or Bluetooth Low Energy, preferably via a cryptographically unprotected communication channel, so that cryptographic protection is essentially provided by the security feature (60) and/or the security mechanism.
3. Security method (100) according to claim 1 or 2,
   characterized in that
   the activation of the security-relevant function according to step d) occurs depending on at least of the verification result and of a signal strength during the transmission of the data unit (50), wherein a distance between the access device (10) and the vehicle (1) is preferably determined on the basis of the signal strength, and the security-relevant function is activated only if the distance is sufficiently small.
4. Security method (100) according to any one of the preceding claims,
   characterized in that
   the user data information (70) comprises at least one device-specific information (70), in particular a device address of the access device (10), preferably a Bluetooth device address, wherein the security feature (60) is determined according to step a) on the basis of the device-specific information (70), so that, preferably according to step c), authentication of the device-specific information (70) and/or an association of the data unit (50) to the access device (10) is carried out on the basis of the device-specific information (70).
5. Security method (100) according to any one of the preceding claims,
   characterized in that
   the activation according to step d) occurs depending on a localization of the access device (10) on the basis of distance information about a distance of the access device (10) from the vehicle (1), wherein at least the following steps are provided before step d):

   - digitally signing user data information (70) for the data unit (50), so that preferably a digital signature is calculated as a security feature (60) for the data unit (50), in particular by the access device (10),

   - transmitting the data unit (50), wherein the user data information (70) and the security feature (60) are transmitted as user data of the data unit (50) from the access device (10) to the vehicle (1), in particular according to step b), wherein preferably the entire user data and/or the user data information (70) of the data unit (50) are transmitted unencrypted,

   - determining the distance information, in particular based on the data transmission (D), preferably based on a measurement of a signal strength during the data transmission (D), preferably by the vehicle (1),

   wherein preferably according to step c) the user data information (70) and/or the distance information is checked, in particular authenticated, on the basis of the security feature (60).
6. Security method (100) according to any one of the preceding claims,
   characterized in that
   in step c), the security feature (60) and/or the user data information (70) is cryptographically verified, preferably by means of at least one verification specification of the security mechanism, preferably by means of a verification algorithm and/or by means of a verification key.
7. Security method (100) according to any one of the preceding claims,
   characterized in that
   according to step c), a positive verification result is determined if the authenticity of the access device (10) and/or the integrity of the data unit (50) is successfully established on the basis of the transmitted security feature (60), wherein, in step d), the activation takes place only if the verification result is positive.
8. Security method (100) according to any one of the preceding claims,
   characterized in that
   the data unit (50), at least on a transport-oriented level, is transmitted unencrypted, and thus comprises at least unencrypted control and/or protocol information and/or at least partially unencrypted user data, in particular at least with unencrypted user data information (70), wherein preferably the data unit (50) is designed as a data packet (50), and preferably the user data comprise at least the security feature (60) unencrypted.
9. Security method (100) according to any one of the preceding claims,
   characterized in that
   the security mechanism comprises at least one cryptographic method for preferably determining at least one association, in particular an authenticity, of the data unit (50), wherein the cryptographic method preferably is a digital signature method and/or is carried out on the basis of at least one random value and/or rolling code and/or the security feature (60) and/or user data information (70) is specific to the access device (10), in particular in that the security feature (60) and/or the user data information (70) is determined directly or indirectly on the basis of device-specific information (70), in particular a device identifier, preferably an identity resolving key, of the access device (10).
10. Security method (100) according to any one of the preceding claims,
    characterized in that
    at least two or three or more receiving nodes (210) of the vehicle (1) are provided in order to receive the at least one data unit (50) in each case and/or to carry out the data transmission (D), wherein the access device (10) is localized depending on the reception and/or the data transmission (D) of the receiving nodes (210) and/or a check of the integrity of the respectively received data units (50), and the at least one security-relevant function is activated depending on the localization.
11. Security method (100) according to any one of the preceding claims,
    characterized in that
    a localization occurs by means of a distance measurement, in particular signal strength measurement, on the basis of the data transmission (D) at different receiving nodes (210) of the vehicle (1), in particular on the basis of the measured distance of the respective receiving nodes (210) from the access device (10), wherein the results of the distance measurement are compared with one another for localization.
12. Security method (100) according to any one of the preceding claims,
    characterized in that
    the data transmission (D) occurs via a public advertising and/or broadcast mode, in particular of a Bluetooth communication technology, so that the transmitted data units and/or user data, in particular also the security feature (60), can be publicly evaluated and/or read, preferably by all the receiving nodes (210) of the vehicle (1).
13. Security system (200) for a vehicle (1) for activating at least one security-relevant function on the vehicle (1) by means of at least one data transmission (D) between a portable access device (10) and the vehicle (1), comprising:

    - at least one receiving node (210) on the vehicle (1), which is designed to receive at least one data unit (50) by the data transmission (D),

    - at least one processing device (220) which is designed to check the received data unit (50) in order to associate the data unit (50) to the access device (10) on the vehicle side,

    wherein the check is carried out on the basis of a security feature (60) of the data unit (50), and the security-relevant function can be activated depending on the check, wherein the data unit (50) comprises user data information (70), and the data unit (50) can be associated to the access device (10) on the vehicle side on the basis of the user data information (70), wherein the security feature (60) can be determined on the basis of the user data information (70) for cryptographic protection of this association in order to sign the user data information (70), wherein the security feature (60) is designed as an electronic signature.
14. Security system (200) according to claim 13,
    characterized in that
    at least one first receiving node (210a) is provided at the vehicle rear and/or at least one second receiving node (210b) is provided in a door handle (2) of the vehicle (1) and/or at least one third receiving node (210c) is provided in the vehicle interior and/or at least one fourth receiving node (210d) is provided in the front region of the vehicle (1), so that, depending on a distance between the access device (10) and the respective receiving nodes (210), a localization of the access device (10) can occur on the basis of the data transmission (D)
    and/or the processing device (220) is configured to perform a security method (100) according to any one of claims 1 to 12.

Images